Exactly who can see what.

Why the chain sees everything

Your ballot is written to a public blockchain. We can decline to return it from our software — and on a default poll, we do — but the data itself sits in contract storage, and anyone can read contract storage directly. No permission, no function call, no cooperation from us.

We know this because we tried it on ourselves. In September 2026 we ran an adversarial review of our own visibility model, and it recovered every ballot and every voter of a default poll straight out of storage while our public getter was correctly refusing. The test that does it is kept in the repository and kept passing, so nobody on our team can quietly forget.

What the default mode actually buys you: no integrator, indexer, dashboard, journalist or API consumer gets your choice handed to them. That is a real reduction in casual exposure. It is not privacy against someone determined, and we will not call it that.

Small votes reveal themselves

If three people vote and the result is published, the result is very close to the ballots. If one person votes, the result is the ballot. This is arithmetic, not a flaw in our software — no gate and no cryptography changes it, including commit–reveal.

It matters because committees, boards and small association votes are exactly this size, and they are the votes we are best suited to today. Run one, and assume the outcome makes individual positions inferable.

What we can see

Everything the chain shows anyone, because it is a public chain. Beyond that:

• Verification data is held off-chain and encrypted at rest. What goes on-chain is a personhood identifier and a commitment — a hash that lets anyone verify your attributes were not altered, while revealing none of them.
• Fine-grained attributes — precinct, postcode, date of birth — are stored but are never queryable. They cannot appear in any published breakdown, by construction rather than by policy.
• Administrative access is logged to an append-only, hash-chained audit trail, and support impersonation is time-boxed, reason-required and recorded.

What we publish about groups

Demographic breakdowns come only from an opt-in panel, never from a binding election, and they are governed separately and more narrowly than the vote itself. A cell is published only with at least 50 people behind it — 100 when the dimension is sensitive — and below that it is withheld rather than estimated. Counts carry calibrated noise, each release states the privacy budget it spent, and queries that would isolate individuals by differencing are refused outright. The detail is on the transparency page.

If you need real secrecy

Use commit–reveal. Instead of publishing a ballot, it publishes a commitment to one, and the ballot is revealed only in a later phase — so the plaintext choice is never sitting in storage waiting to be read.

Check this yourself

None of the above is worth much if you have to take our word for it.

• The transparency explorer rebuilds every poll from on-chain events and shows the block it stopped at, so you can reconcile our numbers against the chain rather than trusting the page.
• Every published breakdown carries the parameters that produced it — the suppression floor, the budget spent, the attestation hash.
• The mechanism, and the list of things we deliberately do not claim, is on how it works.

If you find something on this page that is not true, that is a bug of the most serious kind we have, and we would like to hear about it.